ci: enumerate shellcheck inputs with globstar, not by hand

The hand-listed inputs under-covered silently: commands/*.sh does not glob
into lib/, and the previous fix patched that by adding one more path — which
leaves the same hole open for the next subdirectory. Verified: with a broken
script at commands/deep/nested/bad.sh, the hand-listed invocation still exits 0.

`shopt -s globstar` + bin/* **/*.sh covers every script in the repo, including
the extensionless bin/ entrypoints. The list is printed before it runs, so
coverage is visible in the CI log rather than assumed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -10,7 +10,13 @@ jobs:
       - uses: actions/checkout@v4
       - name: shellcheck
         # -x follows the `source=SCRIPTDIR/...` directives into commands/lib/.
-        # commands/*.sh does not glob into lib/, so list it explicitly.
-        run: shellcheck -x install.sh bin/rig commands/*.sh commands/lib/*.sh test/cli.sh
+        # globstar so a script in a new subdirectory is linted without anyone
+        # remembering to edit this list; bin/* covers the extensionless entrypoints.
+        # The file list is printed so under-coverage shows up in the log.
+        run: |
+          shopt -s globstar
+          files=(bin/* **/*.sh)
+          printf 'shellcheck: %s\n' "${files[@]}"
+          shellcheck -x "${files[@]}"
       - name: cli tests
         run: bash test/cli.sh